North Korean Hackers Use Steganography in Fake Coding Interviews to Steal Developer Credentials
Key Takeaways
- ▸North Korean-aligned group (REF9403/Contagious Interview) successfully bypassed all antivirus vendors by hiding malware inside SVG images using steganography
- ▸Campaign uses sophisticated social engineering—fake job postings and coding challenges—to trick developers into running trojanized repositories
- ▸Four-stage payload (OTTERCOOKIE) steals browser credentials, crypto wallets, files, and clipboard data, providing persistent remote access
Summary
Elastic Security Labs has uncovered a new North Korean-aligned hacking campaign tracked as REF9403 (Contagious Interview) that targets software developers with sophisticated social engineering and malware delivery techniques. The campaign lures developers with fake job postings and coding challenge assignments, then delivers a multi-stage malware payload hidden inside SVG image files using steganography—a technique to conceal data within other files that successfully evaded detection by all major antivirus vendors.
The attack chain works by providing developers with trojanized repositories containing fully functional code (e.g., Next.js e-commerce templates). Hidden within the legitimate-looking code are malicious snippets disguised with benign variable names. When executed, the payload delivers OTTERCOOKIE—a sophisticated toolkit with four distinct capabilities: credential stealing, file exfiltration, a Socket.IO-based remote access trojan (RAT), and clipboard monitoring. Elastic discovered the campaign after DPRK-aligned actors targeted members of its own community Slack workspace with a fake job offer under the alias 'Maxwell'.
The campaign demonstrates how developer accounts remain a high-value target for state-sponsored threat actors, as compromising a single developer can provide initial access for supply chain attacks affecting entire organizations downstream. At the time of discovery, multiple trojanized repositories (next-ecommerce-private-main.zip, shopping-platform-main.zip, ecommerce-platform.zip, and others) showed zero detections across the antivirus ecosystem, highlighting a critical gap in security tooling against novel steganography-based delivery methods.
- Developers remain prime targets for supply chain attacks that can compromise entire organizations through a single compromised individual
- Attack infrastructure and samples showed zero detection at time of discovery, indicating novel attack methodology not yet covered by existing security tools
Editorial Opinion
This campaign illustrates a sobering reality for the security community: sophisticated nation-state actors are willing to invest in zero-day delivery chains targeting individual developers, betting that the ROI from a single compromised engineer accessing sensitive systems justifies the effort. The steganography-based evasion of all antivirus vendors suggests this threat actor has invested significant resources into bypassing existing security paradigms. Organizations must move beyond perimeter defense and credential security to assume developers themselves are a critical attack surface requiring continuous behavioral monitoring, supply chain verification, and zero-trust access controls.
